89 thoughts on “I’m now a Splunk Certified Power User!”

The “Using Splunk” course takes about 5 hours.
The “Searching and Reporting with Splunk” and “Creating Splunk Knowledge Objects” took 1 full day each. These were very intensive and the instructor was really good so you learn a lot.
The “Infrastructure Overview” is a self paced course that is available for 30 days for you too study but it took me about 5 hours in total to review all its content.

Thanks Felipe. I am currently doing the 3rd course in the pipeline, “creating splunk knowledge objects”. Just out of curiosity, Were the questions in the certification exam similar to the graded quiz which we answer at the the end of every course. ?

I faced the same issue now. I have used all of my 3 attempts. The questions for really on a higher level and sometimes not related to the pre-req courses at all. I contacted splunk certification and they gave me 3 more attempts. I havent taken the exam in the new attempts, as I am currently going through the labs one more time. I would tell you any other info if I pass my exam in these additional attempts.

Hello Vinit, the 3 additional retakes were complimentary. You don’t have to pay for them. If you can’t pass in these additional attempts, solunk suggests you to retake the courses and labs again. Good luck

I also failed 2 attempts(65%, 70%), and 3rd attempt got crashed.I have sent an email to ‘certification@splunk.com’ .But i have not seen any response yet.Can some one help me to find out is there any other way to contact or how long do they take to respond back.

From what I understand the Splunk cert test is online. Is it based more along the questions from the final tests and quiz? Or more on what you did during the labs? I’ve done everything except the architecture course. I’ve aced every single final quiz, but have seen people fail the cert test.

Yes, the cert test is online and it is based on everything you saw during the courses, from the content itself to the quizzes, so yes, some people could ace the final quizzes but fail in the cert test. Don’t underestimate the content from the courses.
There are also many questions that you can find on Splunk Docs (http://docs.splunk.com). The test is “open book” so have that website open and the material from the required courses so you can access them easily.

First of all, your response is very helpful. I’m just curious about the format of the quiz. Is it similar to the final quizzes where it is more of a multiple choice and fill in the blanks? Or we will be required to perform simple to complex search syntax?

Yes, There’s only 1 hour to complete the test but that’s more than enough if you’ve done all the required courses and studied previously. In my case I think I finished it with about 10 minutes to spare.

I don’t think there’s another way but to do the courses and study. As I’ve said before, try to have the docs website and PDFs from the courses handy. Also, try to get familiar with the docs website so you know where to find things. You won’t have too much time to browse when doing the test but instead you’ll want to go exactly where you need to go.

First of all, your tips are very helpful. I’m just curious related to the quiz format. Is it similar to the Final Quizzes where it is composed of multiple choices and fill in the blanks? OR we are required to do simple to complex search syntax?

Not that I can think of. I guess the closest thing would be to go to the docs page because all the information from the courses is there, but it is not organized in a way that is useful for you to prepare for the certification test.
Did you try sending an email to the Education team at Splunk?

I am about to start the first course of the series for this certification and need your inputs to know if it is really required to complete all the optional courses as well along with the required courses? Request you to please suggest if you went through the optional courses that are listed? Is going through the required courses should be enough to pass the certification?

The optional courses are not required to pass the test.
I only went though the required courses and that was enough. I will take the optional courses in the near future because they teach you new things that are useful for my job.

i have taken all the 4 courses but unfortunately the “Using SPlunk” course got expired because i did it long back,so could you please suggest me whether the splunk will allow me to take test for Poser user or not.

I think they will let you take the test for Power User if you tell them you have enough experience using Splunk, let’s say at least 1 year using it.
That is what I did when I registered for the test and they asked me how much time I had using Splunk.

I am doing the 4 required courses and haven’t got much time to do all labs and have skipped a few(just downloaded the material). One of the instructors mentions lab work is tracked and not to cheat. Is it really tracked as just by downloading we get the completed mark. I wanted to know the same before I mail for certification exam.
Also regarding certification, is the difficulty level of questions same as of quizzes in course and how much is exam focused on tasks given in lab exercises.

As far as I know, lab work is tracked when they check that you’ve saved the required reports in the lab Splunk environment they give you with each course. I don’t know any other method of tracking. You could just copy-paste the queries and save the reports and you’d be ok, although I don’t recommend this because you wouldn’t learn much.

The difficulty level yeah is kinda the same as the quizzes and I’d say is about 50% focused on the tasks given in lab exercises. There are plenty of questions about concepts and definitions and not so much about checking what a query is doing.

Hi Felipe,
I have cleared exam in my first attempt and got final acknowledgement (showing % for each module/domain), but I did not get certificate to my email, or I can’t see certificate/badge in https://splunkcommunities.force.com. Status is ‘In Progress’, I cleared this exam yesterday.
Is it normal that this certificate/badge is uploaded in some days? Will they also send email certificate afterwords?

Hi Felipe, is there a way to take the final exam without doing the courses, if i have good knowledge in Splunk with 2 years of hands on experience? Or its mandatory to take the course before take the online test?

I’m not sure. I was told by the Splunk Education team that you need to take the courses, at least the searching and reporting and the knowledge objects course. You should send them an email asking this 😉

Splunk has introduced new Splunk User and Power User Certification . I have Successfully given the User Certification yesterday and would be appearing for Power User Next . Any one has got idea about the difference in Level of Exam Questions ?

Splunk User Exam is really a bit hard if you haven’t practiced it well . Questions will be Random on the Lab Sessions too. Please make sure you complete all the modules carefully after reading the Study Module .

I passed the class and am ready to take the exam for Splunk Certified User (not Power).
For the exam, may I ask:
1) Are you notified as you go along whether or not you have answered a question correctly (like in the class test), or do you only find out results after answering all 50 questions?
2) During the test, do we actually have to use the Splunk environment and lab data files on our computer? For instance, to do a search or use a dashboard to return some result to answer a question?
Thank you

1. 50 questions
2. 60 minutes
3. That depends on how well you’re prepared
4. Yes you can search google or read the material from the required courses but since you only have a little more than 1 minute to answer each question, that won’t work in general.

Just finished my Splunk 6.6 Fundamentals Part 1 online course with 90% score overall. Attempting to get to certification . Now in training for Splunk 6.6 Fundamentals Part 2. Is there any certification for Splunk 6.6 Fundamentals Part 2 while going for Splunk 6.6 Fundamentals Part 1 certification?

Splunk fundamentals 1 was quite a jiffy to clear. Although it took me 2 attempts to make it to the certification. I admit with many of you that the course they teach and the questions that they put will bounce you from the seat. They, most of the time, don’t match with the level.

But, during the evaluation, you need to achieve 75% of the correct answers. So, it is not a mandate to complete all the 45 questions in 60 minutes. But better make sure the number of questions answered, and the number of right answers given, should be atleast 75% correct ones. This way, you will get a few minutes under your pocket to scoop out the correct options for the displayed MCQ.

I am at the last day of my fundamentals 2 training. This time, the lab is limited till the last day of the training. Post completion of the training, in another 7 days, SPLUNK will share a link to go through the evaluation portal. Hope this doesn’t make me jump off the seat again!

greetings from Hungary! I’ve kept your blog open on a browser tab for half a year while I was preparing for Certified User and Power User exams. I’ve checked the updates and comments frequently and today evening I said “It is time!”. Long story short from today I’m a Power User too 🙂
Even if we don’t celebrate Thanksgiving I’d like to say thank you for all your comments and advice. You’ve made real value with your attitude.

Its very difficult to get information of Splunk Certification via internet. Thank god I got your blog.

I have done with all the modules for Splunk User certification and applied for the final exam via mail.
But I have few queries below, if you answer them then it would be helpful for me.

1.) What would be the pattern for the final exam for user certification(how many questions and passing marks)?
2.) Can we get dumb questions for final exam of user certification? If yes then from where?
3.) The questions in the final exam will be similar to what they asked after each module and final quiz(after all modules) or they will be different?
4.) There is a lot of confusion in the retake policies for this exam as on splunk site it is mentioned that multiple attempts are allowed while during e-learning(modules) it was told that only one chance will be there to pass the exam. Could you please clarify this?

1) When I took the exam it had 50 questions, but now it changed since now there are 2 certifications: User and Power User. I don’t know how many questions it has now.
2) I couldn’t find any dumb questions other than the ones in the courses.
3) They are similar but some of them are very specific. I think they are a little harder actually. It’s about the same topics you see in the courses but very specific.
4) There is more than 1 chance to retake the exam. Not sure how many but I had a colleage that failed the first attemt and passed the second. There are also some people here in the comments that have failed first and passed after that.

I attempted it for first time but unfortunately I missed it with 63% of score.

Before going to second attempt I have some below queries.

1.) Whats is the end time limit(after 5 Days) of attempting it for second time?

2.) While giving Splunk User Certification exam for first time I found that nearly 15 questions are not from 14 modules(video,quiz and lab assignment) . I have already went through the all 14 modules 4 times each. So after failing in first attempt I am worried from where I should learn things to pass the exam. If you have any document then please refer it to me.

Hello Felipe Cerda, Just stumble upon your blog. Ive just failed my splunk user test with 69% result.. Its true like all you guys said the fundamental 1 quiz/question is more easier than the actual exam question. Gonna go thru all the topics again and focus on the ones that i slack on.

I took the instructor led method because when I did it there was no other option. I think it’s the best because you have the trainer right there with you for the whole time so you can ask questions, while the instructor on demand only gives you a 20 minute session.

I found your blogs very helpful. I passed my Certified User exam last Sunday and Certified Power User exam today (Sunday). The exam questions are definitely tricky and tough than the quizzes. For easy questions, it shouldn’t take more than 5 seconds to finish, so you’ll have plenty time to tackle the hard questions. I had about 10 minutes left for both exams.